registry / get-codex-theme / 0.4.0

get-codex-theme@0.4.0

Create, validate, package, install, use, and restore portable Codex theme packs.

AI Security Review

scanned 8h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Explicit CLI commands install a local runtime that injects cosmetic DOM/CSS changes into a verified local Codex renderer through loopback CDP. An optional macOS watchdog can persist as a user LaunchAgent and restart the themed runtime.

Static reason

No blocking static signals were detected.

Trigger

User runs `launch`, `use --launch`, `resume`, or `watchdog enable`.

Impact

Can alter the local Codex UI and maintain a package-owned background runtime; no unconsented install-time mutation or exfiltration is established.

Mechanism

Local CDP theme injection with opt-in LaunchAgent supervision.

Rationale

Not malicious: all impactful behavior is exposed through explicit commands and guarded local ownership checks. Warn because the package intentionally controls the Codex renderer through CDP and offers opt-in persistent lifecycle setup.

Evidence

package.jsonsrc/index.mjssrc/runtime-control.mjsresources/runtime/injector.mjsresources/runtime/lib/cdp-owner.mjsresources/runtime/watchdog.mjsresources/platforms/macos/watchdog-enable.shresources/platforms/macos/start.sh

Network endpoints2

127.0.0.1:<port>/json/listgetcodextheme.com/api/themes/<id>/download

get-codex-theme@0.4.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code